How to meet it
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Pipeline Fine-Tuning
Register each fine-tuning checkpoint
Verify that fine-tuning checkpoints are registered as distinct artifacts.
OWASP AISVS v1.01, requirement 3.5.4
In plain English
Register each fine-tuning checkpoint as its own artifact, so you can tell exactly which one was tested, approved and deployed.
What good looks like
- Checkpoints get distinct identifiers and registry entries.
- Test results and approvals are linked to a specific checkpoint.
- Old checkpoints are kept or deleted by policy.
How teams usually do it
- Registering checkpoints in the model registry as they are produced.
Evidence an auditor would accept
- Registry entries for recent checkpoints.
Common mistakes
- Overwriting a "latest" checkpoint so you cannot tell which one passed testing.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.